LiteLLM MCP test-endpoint command injection chained to unauthenticated RCE (CVE-2026-42271)

Disclosed vulnerability20 Apr 2026 – 08 Jun 2026

CVE-2026-42271 is a command-injection flaw in BerriAI's LiteLLM, the open-source AI gateway/proxy routing across many LLM providers. Per the maintainers' advisory and Horizon3.ai, two endpoints meant to preview an MCP server before saving — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full stdio server config (command, args, env) and, when invoked, spawned the supplied command as a subprocess on the proxy host as the LiteLLM process user. CVSS reportedly 8.7; affects versions >= 1.74.2 and < 1.83.7; patched in 1.83.7 (reportedly released 8 May 2026). As disclosed 20 Apr 2026 it required a valid proxy API key; Horizon3.ai then showed chaining CVE-2026-48710 (a Starlette 'BadHost' Host-header validation bypass, <= 1.0.0, disclosed 26 May 2026) sidesteps auth entirely for unauthenticated RCE (combined CVSS reportedly 10.0), validated 1 Jun 2026. On 8 Jun 2026 CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog citing in-the-wild exploitation. Successful exploitation runs arbitrary commands on the gateway host and reaches the multi-provider LLM API keys the proxy concentrates. Distinct from the March 2026 TeamPCP PyPI supply-chain compromise: here the shipped gateway itself acts as a confused deputy executing an attacker-supplied MCP 'connection test' command. Figures, CVSS scores and the exploitation assessment are as reported; endpoint and payload details are illustrative.

Risks it illustrates

Unsafe Tool / Code Execution Confused Deputy (cross-agent)

Sources

Practise the risk class — related scenarios

Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).

🔗One Click, Permanent Trust

An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory

🪄The Approval That Lied

A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys

🗄️When the Query Bites Back

A text-to-SQL agent runs the model's output straight at the database

🧩Summarise This, Run That

An auto-approving coding agent reads a poisoned page — and executes code it never should have

🪤The Bug Report That Ran Code

A fake Sentry error report hijacks a developer's coding agent into running a shell command

🔗The Chain of Innocent Commands

Every command is harmless on its own — the sequence is the exploit

📦The Dataset That Ran Code

A 'safe' dataset preview turns an upload into code execution on the pipeline's workers

🕵️The Link That Hired an Insider

One click provisions an attacker-configured agent inside your own workspace

🕵️The Logs That Lied

An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence

📡The Message in Morse

Encoded public text is laundered across an agent handoff into an on-chain transfer

🪪The Worker Who Spoke for the Boss

A poisoned web page hijacks a research agent — and the planner acts on its behalf

🖱️What You Click Is Not What You Get

A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'

More cases on Unsafe Tool / Code Execution

Replit AI agent deletes a production database GTG-1002 — first reported AI-orchestrated cyber-espionage campaign (Claude Code)IDEsaster — AI coding IDEs/agents turned into exfiltration & RCE surfaces GitHub Copilot / VS Code RCE via prompt injection ('YOLO mode', CVE-2025-53773)Model Namespace Reuse (Hugging Face name-trust hijack)Amazon Q Developer 'wiper' prompt shipped via poisoned pull request (CVE-2025-8217)NVIDIA Triton Inference Server unauthenticated RCE chain (CVE-2025-23319 / -23320 / -23334)TeamPCP poisons the LiteLLM AI gateway on PyPI to harvest LLM API keys Agentjacking — hijacking AI coding agents via Sentry error reports (Tenet Security)LeRobot async-inference gRPC pickle RCE (CVE-2026-25874)Flowise AI agent builder CustomMCP RCE (CVE-2025-59528)Project Glasswing — Claude 'Mythos' autonomously finds 10,000+ software vulnerabilities AI-assisted breach of Mexican government infrastructure (Claude Code + GPT-4.1)Hugging Face agentic production intrusion via a poisoned dataset (July 2026)Amazon Q Developer auto-loads workspace MCP configs, enabling zero-click AWS credential theft (CVE-2026-12957)Cursor 'DuneSlide' — indirect prompt injection escapes the IDE sandbox to zero-click RCE (CVE-2026-50548 / CVE-2026-50549)Hermes AI agent run unattended ('YOLO' mode) to automate post-exploitation at Thailand's Ministry of Finance JADEPUFFER — first documented end-to-end autonomous agentic ransomware operation (Sysdig)Agentic botnets via universal, transferable adversarial HalluSquatting GhostApproval — symlink following + approval-UI misrepresentation defeats human-in-the-loop in six AI coding assistants (CVE-2026-12958 / CVE-2026-50549)MOSAIC: CLI command-composition attacks on LLM coding agents Agent Data Injection: malicious trusted-data bypasses prompt-injection defenses Claude Code Opus 5 Auto Mode hijacked to RCE via indirect prompt injection AWS Kiro agentic IDE rewrites its own MCP config for zero-click RCE (CVE-2026-10591)Frontier models escape air-gapped eval harnesses (incl. Claude PyPI malware)CISA/NSA/FBI warn of AI-generated exploit scripts targeting Siemens S7 PLCs (AA26-231A)ServiceNow AI Platform pre-auth sandbox-escape RCE (CVE-2026-6875)The Week of Sandbox Escapes: AI coding-agent sandbox bypasses (CVE-2026-48124 and more)keyv/cacheable npm worm plants Claude Code and VS Code hook files as an AI-agent execution vector Langflow unauthenticated code-injection RCE added to CISA KEV (CVE-2026-9198)